Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

CWS_NS3 Problem

RyanB0811

Posted 10 August 2004 - 01:37 PM

RyanB0811

New Member

Member

5 posts

I have run Spy Sweeper quite a few times and it continues to find and remove CWS_NS3. I am not the most computer literate, but I catch on quickly. Without help I've gotten this far. I don't know how to read the HJT log but I knew to get it. If there is any help that can be given I would thoroughly appreciate it.

RyanB0811

Posted 10 August 2004 - 02:42 PM

RyanB0811

New Member

Topic Starter

Member

5 posts

I ran CWShredder and rebooted. When I did that, Spy Sweeper sent alerts about d3tp.exe and ctfmon.exe An error message came up about APIVF32.exe. Here is the hjt log. Thanks for the help.Logfile of HijackThis v1.97.7Scan saved at 3:36:20 PM, on 8/10/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

ditto

Posted 10 August 2004 - 03:06 PM

ditto

- i pwn n00bs -

Member

1,260 posts

Hello again RyanB0811,

Before we start cleaning up your log, please run Ad-Aware.Download the latest version of Ad-Aware from here (if you already have Ad-Aware installed, make sure that it is the latest version and always go online and update it before you run it).

After installing AAW, and before running the program, you must FIRST update the reference file following these instuctions. (and you must always do this before you run the program at any later date).

RyanB0811

Posted 10 August 2004 - 03:33 PM

RyanB0811

New Member

Topic Starter

Member

5 posts

The same alerts and errors showed up when I rebooted. Here is the new hjt log.Logfile of HijackThis v1.97.7Scan saved at 4:29:31 PM, on 8/10/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

not-a-geek

Posted 25 August 2004 - 07:29 AM

not-a-geek

New Member

Member

2 posts

Hello!I tackled the CWS_NS3 problem and here's the solution that I found. It's easier than you think. Those crazy folks want $40 for the removal tool download... yeah, right.Anyway, here is what you do:

Open the Uninstall folder and find and DELETE any 2 and 3 letter folders. They don't belong there and that's where the trojan is hiding.Delete all of them and restart computer. Run either Spy Sweeper or Ad Aware to remove all the traces.Turn the System Restore back on. The CWS_NS3 is gone forever.

not-a-geek

Posted 25 August 2004 - 01:00 PM

not-a-geek

New Member

Member

2 posts

I got this success e-mai:

Thank you for your post on spywareinfo.com regarding removal of CWS_NS3. I have been working on removing this spyware for 1.5 days using various spyware removal tools. (adaware, spybot s&d, about:buster, TDS-3, spy sweeper, hijack this, and spyware guard) with no success.

After using your method it has not returned.

Thanks again,
-William
---------------------------

This is what you do to get rid of the CWS_NS3 trojan:

Turn off the System Restore
then go to: Run, type Regedit
then: HKEY_LOCAL_MACHINE_Software_Microsoft_Windows_Current_Uninstall

Open Uninstall folder and find and DELETE any 2 and 3 letter folders. (Only two and three). They don't belong there and that's where the trojan is hiding.
Delete all of them and restart computer. Run either Spy Sweeper or Ad Aware to remove all the traces.
Turn the System Restore back on. The CWS_NS3 is gone forever.

Not-a-geek. Spread the word!!!

PS Do not listen to some of the geeks who you'd see critisize this way of removing it. I am afraid that some of them create those things so that they could get money from you later for removing it.